In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Dec 8, 2019 |
| Ubuntu | — | Upgrade linux-image-oem-osp1Upgrade linux-image-gkeop-5.4Upgrade linux-image-snapdragonUpgrade linux-image-oemUpgrade linux-image-4.15.0-1111-gcpUpgrade linux-image-4.15.0-1098-raspi2Upgrade linux-image-4.4.0-222-genericUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1007-ibmUpgrade linux-image-aws-lts-18.04Upgrade linux-image-virtualUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-lpaeUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-4.15.0-1126-azureUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.15.0-1030-dell300xUpgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-18.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-gkeopUpgrade linux-image-5.4.0-1057-oracleUpgrade linux-image-4.4.0-1138-awsUpgrade linux-image-5.4.0-1057-gcpUpgrade linux-image-genericUpgrade linux-image-gkeUpgrade linux-image-4.15.0-1115-awsUpgrade linux-image-dell300xUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-5.4.0-1063-azureUpgrade linux-image-4.15.0-162-generic-lpaeUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1055-gkeUpgrade linux-image-4.4.0-1103-kvmUpgrade linux-image-oracleUpgrade linux-image-5.4.0-90-lowlatencyUpgrade linux-image-5.4.0-90-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-bluefieldUpgrade linux-image-4.15.0-162-lowlatencyUpgrade linux-image-5.4.0-1026-gkeopUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-raspi2Upgrade linux-image-4.15.0-1115-snapdragonUpgrade linux-image-4.15.0-1083-oracleUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1046-raspiUpgrade linux-image-4.4.0-1102-awsUpgrade linux-image-5.4.0-1059-awsUpgrade linux-image-4.15.0-162-genericUpgrade linux-image-raspiUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.8.0-1043-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-gke-5.4Upgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-4.15.0-1102-kvmUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-ibmUpgrade linux-image-5.4.0-1021-bluefieldUpgrade linux-image-azureUpgrade linux-image-5.4.0-90-genericUpgrade linux-image-5.4.0-1049-kvmUpgrade linux-image-aws-hweUpgrade linux-image-4.4.0-222-lowlatencyUpgrade linux-image-virtual-hwe-18.04 | Oct 22, 2021 | Dec 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub